Medical/Dental Real, reported: nothing added or dramatized

Look what happened to these healthcare organizations, so it doesn't happen to your practice

By FraudMeNot Team

Label: "Real, reported: based on public records, cited below. Nothing added or dramatized." Source: https://www.hhs.gov/press-room/ocr-settles-four-ransomware-investigations.html

The story

On April 23, 2026, the HHS Office for Civil Rights (OCR) announced settlements with four regulated entities following separate ransomware investigations under the HIPAA Security Rule. According to HHS, the breaches collectively affected over 427,000 individuals; the entities agreed to implement corrective action plans subject to OCR monitoring for two years and paid a total of $1,165,000 to OCR. (Source 1)

Two of the four, as described by HHS: - Regional Women's Health Group, LLC (d/b/a Axia Women's Health). According to HHS, it reported in December 2020 that an unauthorized third party gained access to its IT network and potentially exfiltrated data from its electronic medical record database; the breach affected 37,989 individuals. OCR's investigation found that it failed to conduct an accurate and thorough risk analysis. It paid $320,000 to OCR and committed to corrective actions. (Source 1) The resolution agreement states it "is not an admission of liability." (Source 2) - Assured Imaging Affiliated Covered Entities ("Assured Imaging"). According to HHS, it reported in May 2020 that a server on its network was infected with ransomware; the breach affected 244,813 individuals. OCR's investigation determined that Assured Imaging had impermissibly disclosed PHI, failed to conduct an accurate and thorough risk analysis, and failed to timely notify affected individuals of the breach. It paid $375,000 to OCR and committed to corrective actions. (Source 1) The resolution agreement states it "is not an admission of liability." (Source 3)

Both entities settled without admitting liability.

The common thread in OCR's findings for both: no accurate and thorough risk analysis. Our take: that's an assessment many small practices may never have done, and it's worth doing before anything goes wrong.

The moment it could have been stopped

Our take: before an attack. HHS recommends identifying where ePHI is located, including how it enters, flows through, and leaves your systems, and periodically conducting and updating a risk analysis. (Source 1)

Tips (general)

1. Do a real HIPAA risk analysis and update it when systems change.
2. Retire or isolate old servers and backups that hold patient data.
3. Keep offline or immutable backups and test restoring them.
4. Use MFA on email, EHR, and remote access.
5. Know your breach-notification timelines before you need them.

Find your state: see where to report a scam in your state.

Sources

1. HHS, "HHS' Office for Civil Rights Settles Four HIPAA Security Rule Ransomware Investigations," Apr. 23, 2026. https://www.hhs.gov/press-room/ocr-settles-four-ransomware-investigations.html
2. HHS, Regional Women's Health Group, LLC Resolution Agreement and Corrective Action Plan. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/ra-cap-with-rwhg/index.html
3. HHS, Assured Imaging Resolution Agreement and Corrective Action Plan. https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/ra-cap-with-assured-imaging/index.html

Disclaimer. FraudMeNot content, including the Close Call Report, is general educational and awareness material only. It is not legal, financial, tax, compliance, or cybersecurity advice, and it is not a security service or assessment. Nothing here creates a professional or advisory relationship. Content is provided "as is" without warranties; it may contain errors or become outdated, and no step described can guarantee prevention of fraud or loss. Consult a qualified attorney, accountant, financial professional, or security provider about your specific situation. If you've been scammed, contact your bank immediately and report it at reportfraud.ftc.gov and ic3.gov.

Story labels. Stories may be dramatized or composite; see each label. Each story carries one label: Real, reported: nothing added or dramatized (based on public records, linked), Real, reported (based on public sources, linked; details may be dramatized), Composite/dramatized (based on common patterns; names, places and numbers are invented, and any resemblance to real persons or firms is coincidental), or Hypothetical. People named in reported cases who haven't been convicted are presumed innocent; allegations are only allegations.

AI disclosure. Narration is AI-generated (text-to-speech). Scripts are researched and reviewed by a person. Some visuals may be AI-generated or stock.

Affiliate/sponsor note. We may earn commissions or sponsorship fees; see disclosures in each item.

Affiliate/sponsor disclosure for this item: none (no affiliate links or sponsors).